GoKawiilFake 'Plus 5.6' ChatGPT bot used to push malware via ClickFix scam
Security firm Huntress found attackers had built a Custom GPT named 'Plus 5.6' hosted on the real ChatGPT.com domain, designed to look like an official OpenAI model. The bot told users ChatGPT was unavailable and pushed them to a fake Cloudflare security check page that instructed them to copy and paste a Windows command, a technique known as ClickFix, which could install malware capable of accessing files, screens, webcams and microphones. Huntress says some victims reached the fake bot via a sponsored Google ad for 'ChatGPT' placed above organic search results.
GoKawiil's interpretation of the reporting above, not reported fact.
The campaign shows how attackers can exploit trusted platforms' own hosting infrastructure to bypass the usual warning signs, like odd URLs, that users rely on to judge legitimacy. Because the ClickFix method relies on tricking a user into executing the harmful step themselves rather than exploiting a technical flaw, it could be harder for conventional security software to flag. The use of paid search ads to surface the fake tool suggests attackers are also willing to pay to rank above genuine results for popular brand searches.
- A malicious Custom GPT named 'Plus 5.6' was hosted on the legitimate ChatGPT.com domain.
- It redirected users to a fake Cloudflare check using the ClickFix technique to get them to run a malicious Windows command.
- Some victims found the fake bot through a sponsored Google ad for 'ChatGPT' appearing above regular search results.
Malwarebytes Premium Antivirus — With scams now hiding behind trusted sites like ChatGPT, having real-time malware protection on your PC is more important than ever. Malwarebytes Premium actively blocks malicious scripts and fake security prompts before they can install spyware or steal your data. It's a smart layer of defense against exactly this kind of social-engineering attack.
See Malwarebytes Premium Antivirus on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: androidauthority.com, 2026-10-01
Published there as: “A real ChatGPT page is being used to trick people into installing malware”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.